Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

…for clusterdeployments

Signed-off-by: Tomer Figenblat <[email protected]>

Signed-off-by: Tomer Figenblat <[email protected]>

- Added new section for to configure the ArgoCD server to support tls
  argocdServer:
    route:
      tls:
        insecureEdgeTerminationPolicy: Redirect
        termination: reencrypt
- Default for ArgoCD is to create route with the following:
      route: enabled
      tls:
        insecureEdgeTerminationPolicy: Redirect
        termination: passthrough

    For more information please refer to https://issues.redhat.com/browse/GITOPS-3918.

- Changed default value for termination

Improve readme for ACM IIB

New global scope argocdServer section for values-global.yaml

We drive this from the patterns-operator-config configmap these days, which
makes more sense (it is a clusterwide setting and not really a per
pattern one).

Tested with:

❯ helm template operator-install --show-only templates/subscription.yaml --set main.patternsOperator.installPlanApproval=Manual

    ---
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: patterns-operator
      namespace: openshift-operators
      labels:
        operators.coreos.com/patterns-operator.openshift-operators: ""
    spec:
      channel: fast
      installPlanApproval: Manual
      name: patterns-operator
      source: community-operators
      sourceNamespace: openshift-marketplace

❯ helm template operator-install --show-only templates/subscription.yaml --set main.patternsOperator.installPlanApproval=Manual --set main.patternsOperator.startingCSV=1.2.3

    ---
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: patterns-operator
      namespace: openshift-operators
      labels:
        operators.coreos.com/patterns-operator.openshift-operators: ""
    spec:
      channel: fast
      installPlanApproval: Manual
      name: patterns-operator
      source: community-operators
      sourceNamespace: openshift-marketplace
      startingCSV: 1.2.3

Drop gitopsspec from pattern's CR

Allow customizing the VP operator subscription

Add retries when checking oc version

Add an imperative-admin-sa service account

This makes the registry url more consistent with what we already use
(e.g. in the imperative templates)

Switch to registry.redhat.io for the initContainer image

- If statement was checking for .Values.global.extraValueFiles.
- We now checking at the .extraValueFiles in the managedClusterGroups section.

  managedClusterGroups:
    aro-prod:
      name: innovation
      acmlabels:
        - name: clusterGroup
          value: innovation
      extraValueFiles:
        - '/overrides/values-common-capabilities.yaml'
      helmOverrides:
        - name: clusterGroup.isHubCluster
          value: "false"

Update for ACM chart to application-policies.yaml

- Problem Statement
  The current **clustergroup** schema does not allow the definition of **extraParameters** under the **main** section of a values file.

- Caveat
  The user defined variables in the **extraParameters** section would only be applied if the user deploys the pattern via the command, using `./pattern.sh make install` or `./pattern.sh make operator-deploy` and not via the OpenShift Validated Patterns Operator UI.

- Fix Description
  Add the **extraParameters** to the definition of **Main.properties** in the values.schema.json:

        "extraParameters": {
          "type": "array",
          "description": "Pass in extra Helm parameters to all ArgoCD Applications and the framework."
        },

- This will allow users to define extra parameters that will be added by the framework to the ArgoCD applications it creates.

- For more information see validatedpatterns/common#510

Add extraParameters to values.schema.json

Update ESO to 0.9.18

…n of a values file.

- The operator adds these extraParameters to the extraParametersNested section as key/value pairs in the Cluster Wide ArgoCD Application created by the Validated Patterns operator.
- This update will add the user defined extra parameters on the ArgoCD Applications on the Spoke Clusters.

efinition of extraParameters under the main

We'd like to make the imperative namespace optional,
so let's use the golang-external-secrets one, which is probably
more correct anyways since the acm hub ca is tied to ESO anyways.

The acm hub ca is needed for ESO on spokes to connect to the vault on
the hub, there is no need for this when vault is not used, so let's
drop it in that case

Feat: Followup to definition of extraParameters under the main section of a values file.

Updates to acm-hub-ca

Update vault to 1.16.2

…er-namespace

Co-authored-by: Michele Baldessari <[email protected]>
Co-authored-by: Alejandro Villegas <[email protected]>
Signed-off-by: Tomer Figenblat <[email protected]>

This is important because in some situations (we've observed this on the
clusterwide argo instance on spokes) the permissions are not there yet
when argo tries to create service accounts for the imperative SAs.

This means that the very first sync works up to the service account
creation which then fails due to lacking RBACs. This triggers a gitops
issue where selfheal never retries because the previous run failed and
so the app is in a stuck loop forever

Co-Authored-By: Jonny Rickard <[email protected]>

Closes: GITOPS-4677

Force rolebindings as early as possible

Problem Statement:
When setting a namespace like this:
    - openshift-distributed-tracing:
        operatorGroup: true
        targetNamespaces: []

The chart generates the following yaml:
```yaml
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: openshift-distributed-tracing-operator-group
  namespace: openshift-distributed-tracing
spec:
  targetNamespaces:
```

Which k8s rejects the targetNamespaces key as invalid when it attempts to apply it and removes it since it doesn't have a value, which just so happens to have the desired result of not setting the targetNamespaces (or a selector) to enable it for All Namespaces.

bug: Invalid OperatorGroup generated when omitting targetNamespaces

feat: use hive clusterdeployment for creating spoke clusters

Fix CI issue

…sters

Added support to control the scheduler/cluster spec

Simplified PR for auto approve install plans

Actually use adminServiceAccountName for the auto approve job

This should fix the fact that jobs are triggered on unrelated changes

Make sure that the if condition on chart split is not always true

Bump super-linter from 5 to 6

Add some debugging to the chart split action

Otherwise we will get errors during the command as git subtree has
regressed since v2.44.0

Use a specific git version when running git subtree split

Release clustergroup v0.8.6

Add sudo to apt-get invocation

Add some READMEs in the individual charts

When setting up vault we loop through all the managed clusters and set
up the token so ESO can fetch certain paths in vault. This happens in
the unseal vault ansible job and will fail if one of the managed
clusters is unreachable. This is undesirable because a cluster might
have been shut down on purpose or might be temporarily not reachable
and this is no reason to stop the configuration of vault.

Tested as follows:
1. Deployed mcg on sno1 and sno2. All green.
2. Shut off sno2 so it is unreachable. observed unseal-cronjob fail (took a while but eventually failed with:
   ```
   TASK [vault_utils : Fetch remote ansible to remote cluster] ********************
   ok: [localhost] => (item=local-cluster)
   An exception occurred during task execution. To see the full traceback, use -vvv. The error was: urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.sno2.ocplab.ocp', port=6443): Max retries exceeded with url: /version (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f1e08dd4670>: Failed to establish a new connection: [Errno 110] Connection timed out'))
   failed: [localhost] (item=sno2) => {"ansible_loop_var": "item", "changed": false, "item": {"key": "sno2", "value": {"bearerToken": "eyJhbGciOiJSUzI1...
     ```
3. Imported sno3 into the hub on sno1. observed unseal-cronjob still fail:
   ```
   TASK [vault_utils : Fetch remote ansible to remote cluster] ********************
   ok: [localhost] => (item=local-cluster)
   An exception occurred during task execution. To see the full traceback, use -vvv. The error was: urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.sno2.ocplab.ocp', port=6443): Max retries exceeded with url: /version (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7fb5d293e0a0>: Failed to establish a new connection: [Errno 110] Connection timed out'))
   failed: [localhost] (item=sno2) => {"ansible_loop_var": "item", "changed": false, "item": {"key": "sno2", "value": {"bearerToken": "ey...
   ok: [localhost] => (item=sno3)
   PLAY RECAP *********************************************************************
   localhost : ok=37 changed=11 unreachable=0 failed=1 skipped=13 rescued=0 ignored=0
   ```
4. After the ignore_errors patch:
   ```
   TASK [vault_utils : Fetch remote ansible to remote cluster] ********************
   ok: [localhost] => (item=local-cluster)
   An exception occurred during task execution. To see the full traceback, use -vvv. The error was: urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='api.sno2.ocplab.ocp', port=6443): Max retries exceeded with url: /version (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7fc4b7805670>: Failed to establish a new connection: [Errno 110] Connection timed out'))
   failed: [localhost] (item=sno2) => {"ansible_loop_var": "item", "changed": false, "item": {"key": "sno2", "value": {"bearerToken": "eyJhb....
   ok: [localhost] => (item=sno3)
   ...ignoring
   # sno2 correctly gets skipped in the subsequent tasks
   ```
   sno3 did manage to login to the vault and everything just worked

Reported-by: François Charette <[email protected]>

Skip unreachable spokes when setting up vault

Add no_log to spokes initialization task

This will allow us to work with external CAs out of the box and also it
will allow the framework to be able use internal gitea instances out of
the box.

Tested as follows:
1. Deployed stock MCG with no changes
2. Changed the MCG repo to one with this patch
3. Observed initContainers to show up on:
   A. namespaced argo on hub
   B. clusterwide argo on spoke
   C. namespaced argo on spoke
4. All applications still worked
5. Deployed mcg from scratch using a branch with this patch (with
   multisource set to false so we're sure we're testing the right common
   bits in the branch)

Make initContainers the default

Release clustergroup v0.8.7

Upgrade ESO to v0.9.19

It's the version gitops 1.12 is using these days:

❯ oc exec -it -n openshift-gitops openshift-gitops-repo-server-66bf746964-926qk -c argocd-repo-server -- bash -c "helm version"
version.BuildInfo{Version:"v3.14.0", GitCommit:"2a2fb3b98829f1e0be6fb18af2f6599e0f4e8243", GitTreeState:"", GoVersion:"go1.21.9 (Red Hat 1.21.9-1.module+el8.10.0+21671+b35c3b78)"}

Update helm version in CI to 3.14.0

Now that we switched to imperative.initcontainers.gitinit-ca, the older
define is not used anywhere, so we can drop this.

Otherwise if HEAD is specified we get the following:

    mkdir: cannot create directory '/git/home': File exists
    Cloning into '/git/repo'...
    warning: Could not find remote branch HEAD to clone.
    fatal: Remote branch HEAD not found in upstream origin

Make unseal HEAD work

Make healthchecks configurable

Make resourcehealthchecks configurable

Otherwise we might error out with:

    error: unknown option `branch qe_test-16831'
    usage: git clone [<options>] [--] <repo> [<dir>]

Do not quote $BRANCH variable

initContainers on the clusterwide argo instances on spokes rely on a
configmap called "trusted-ca-bundle" that gets created by ACM in the
openshift-gitops namespace.

Since we have no explicit guarantees about ordering, it might happen
that the argocd object gets created by acm before the configmap. This
is problematic because the init container will start but just ignore
the missing configmap.

Solve this by splitting the ocp-gitops-policy in two and making sure
that both the openshift-gitops subscription and the trusted-ca-bundle
configmap are green before applying the next dependency.

Fix initcontainer race on spokes

Release clustergroup v0.8.8

configure annotation based resource tracking

With the switch to initcontainers they are not used anywhere anymore

Drop imperative.volumes and imperative.volumemounts

When using a password with a dollar, the oc exec commands run inside the
vault are not properly escaped, casing the dollar signed to be
interpreted by the shell inside the vault pod.

So a password like 'Y$yxn54&qXAxpUd2*yGH' will become 'Y&qXAxpUd2*yGH'
in the vault.

This is because the command that is being run ends up being:

    oc exec -n vault vault-0 -i -- sh -c "vault kv patch -mount=secret global/mysecret dollar=Y$yxn54&qXAxpUd2*yGH"

The `$yxn54` will be interpreted by the shell inside vault.

Let's fix this by running a properly escaped command:

    oc exec -n vault vault-0 -i -- sh -c "vault kv patch -mount=secret global/mysecret dollar='"'Y$yxn54&qXAxpUd2*yGH'"'"

Reported-By: Chris Butler <[email protected]>

With this change we push the hub CA to the spokes in both the
openshift-gitops, the namespaced argo namespace and in the imperative
namespace.

We do this so that the two argo instances are allowed to clone from an
eventual gitea repository on the hub. Same goes for the imperative
framework which might need to clone the code from the in-cluster gitea
service running on the hub.